{
 "id": "WPSEC-2026-2813",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2813/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2813/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2813/index.md",
 "title": "King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder <= 51.1.87 - Unauthenticated Sensitive Information Exposure via Faceted Filters AJAX Widget Rendering",
 "description": "The King Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure via the Shop Filters (Faceted Filters) AJAX action king_addons_faceted_filters in all versions up to, and including, 51.1.87. This is due to the handler loading and rendering any saved Elementor element identified by user-supplied 'post_id' and 'widget_id' values, without checking that the document is published and not password-protected or that the element is a filter-enabled grid. The nonce it checks is printed on public pages. This makes it possible for unauthenticated attackers who know an element ID to render content from private, draft or password-protected Elementor documents.",
 "plugin": {
  "slug": "king-addons",
  "name": "King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder",
  "full_name": "King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder",
  "wordpress_org": "https://wordpress.org/plugins/king-addons/",
  "advisories_url": "https://wpsec.com/vuln/plugin/king-addons/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/king-addons"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "51.1.90",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 51.1.90"
  ]
 },
 "introduced_in": null,
 "fixed_in": "51.1.90",
 "remediation": "Update to 51.1.90 or later.",
 "fix_released": "2026-11-09T14:56:33+00:00",
 "published": "2026-11-10T15:48:02+00:00",
 "updated": "2026-11-09T23:34:03.305762+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2813/",
  "https://plugins.svn.wordpress.org/king-addons/tags/51.1.90/",
  "https://wordpress.org/plugins/king-addons/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/king-addons",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-10"
 }
}